1

I'm trying to wipe some of my older (NTFS, external) hard drives, but even after using 'Wipe free space' programs like CCleaner and Eraser, the file names are still visible in file recovery programs. I'm guessing this is because the MFT, journal, etc. are still present and contain references to these files.

My first thought was to just format the drive and then wipe, but I'm guessing that's still not totally going to do the trick. Would formatting to exFAT and then wiping make a difference (as it uses a different structure)?

Edit: This is not a duplicate. The other thread does not mention wiping file references specifically, and the top answer is to use DBAN, which is not a possibility with external drives.

  • 2
    Possible duplicate of [Securely erasing all data from a hard drive](https://superuser.com/questions/4678/securely-erasing-all-data-from-a-hard-drive) – sleske May 01 '18 at 02:23
  • 1
    First you write about "wiping free space", then about "formatting the drive". What do you want - wipe free space, but keep data, or wipe everything? – sleske May 01 '18 at 02:25
  • Wipe everything, so it can't be recovered. I mentioned formatting the drive because simply wiping free space on the drive as is would not touch the MFT, etc. that contain file references. –  May 01 '18 at 02:30
  • This is not a duplicate. The other thread does not mention wiping file references specifically, and the top answer is to use DBAN, which is not a possibility with external drives. –  May 01 '18 at 02:32
  • I don't see how it matters that the other thread does not mention file references - wiping a disks wipes *everything*. Also a) DBAN does support external drives (at least some versions), and b) the other answer offer other options, which also work with external drives. – sleske May 01 '18 at 02:45
  • It is a duplicate because it has other answers that meet your needs. They don't need to mention file references because this get wiped when the data does. – Moab May 01 '18 at 15:25
  • DBAN doesn't know or care whether the drive is internal or external. – psusi May 01 '18 at 18:11

2 Answers2

2

Try using Microsoft's built in free space wiping tool. Open an administrative command prompt, go to the drive to wipe and type:

cipher /w:F

Keltari
  • 71,875
  • 26
  • 179
  • 229
1

Preventing Data Recovery

In order to prevent data from being recovered, the data itself and all references to it should be overwritten. There is ongoing discussion as to how exactly it should be overwritten (number of times, patterns used, etc.) so you should choose based on the importance of the data not being recovered, and the reason for making it so.

Windows

If (as assumed by your use of NTFS) you are using a recent (Vista or newer) Microsoft OS, there is the format command available, which will write zeros to the disk when you do a standard (non-quick) format.

This only erases the partition you select, so keep that in mind if you have more than one.

Linux

If you are using Linux, or are willing to boot off a Linux disk to wipe your drive, the entire disk can be erased using the dd utility. For example, to completely overwrite the partition table and all data, you could run:

dd if=/dev/zero of=/dev/sda

Warning!

Modern hard drives may have wear leveling or other features that result in some storage space being untouched using the above methods.

It may be possible to ensure all data is removed by using the "Secure erase" feature of the drive - assuming you trust the manufacturer. This can be done using the hdparm tool by:

Setting the password

# hdparm --user-master u --security-set-pass Pass /dev/sda
security_password="Pass"

Running secure erase

# hdparm --user-master u --security-erase Pass /dev/sda
security_password="Pass"

Verifying

# hdparm -I /dev/sdb
DougC
  • 344
  • 3
  • 6